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In free-space quantum key distribution (QKD), the sensitivity of the receiver’s detector channels 
may depend differently on the spatial mode of incoming photons. Consequently, an attacker can 
control the spatial mode to break security. We experimentally investigate a standard polarization 
QKD receiver, and identify sources of efficiency mismatch in its optical scheme. We model a practical 
intercept-and-resend attack and show that it would break security in most situations. We show 
experimentally that adding an appropriately chosen spatial filter at the receiver’s entrance may be 
an effective countermeasure. 


I. INTRODUCTION 

Quantum key distribution (QKD) [TJ|2], in theory, al¬ 
lows two distant parties Alice and Bob to establish a 
shared secret key with unconditional security mZ]. Al¬ 
though a number of successful implementations of QKD 
have been reported [Mil] and commercialization is un¬ 
derway [12], the technology is yet to achieve widespread 
use. One important reason is that the maximum distance 
is still of the order of 300 km [T3| in fiber-based sys¬ 
tems. Consequently, implementation of free-space QKD 
utilizing ground-to-satellite links [HHHj that promises 
long-distance quantum communication is now a very at¬ 
tractive field of research. 

Implementation imperfections have enabled a number 
of successful attacks on QKD P5H5T| . The main reason 
behind this is the deviation of the actual behaviour of 
the devices from the ideal expected behaviour. Thus, 
to guarantee the security, it is of utmost importance 
to scrutinize the practical device behaviours for possible 
deviations. One such source of deviation in free-space 
QKD can be the assumed symmetry of detection effi¬ 
ciency among all received quantum states in Bob’s de¬ 
tector [2MM1 [H21 133| . If a deviation from this assump¬ 
tion exists, an adversary Eve can send light to Bob in 
different spatial modes so that one of his detectors has 
a relatively higher probability of click than the other de- 
tector(s) ( 33 ). In this way, she can exploit the mismatch 
in efficiency and make Bob’s measurement outcome de¬ 
pendent on his measurement basis and correlated to Eve, 
which breaks the assumptions of typical security proofs. 
In this work, we investigate how crucial this can be to the 
security of QKD. (While finishing this paper, we became 
aware of a recent similar work |35j .) 

We study a receiver designed for polarization encod¬ 
ing free-space QKD, described in Sec. [llj We test it in 
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Sec. jnT] by sending an attenuated laser beam to the re¬ 
ceiver with various angle offsets and recording the relative 
detection probability in each channel, to find incidence 
angles with high efficiency mismatch. With these data, 
we show in Sec. IVjby numerical modeling that an eaves¬ 
dropper attack exists that enables Eve to steal the secret 
key. We discuss countermeasures in Sec.jVjand conclude 
in Sec. IVII 


II. QKD SYSTEM UNDER TEST 

A free-space QKD receiver typically employs a tele¬ 
scope to reduce the size of a collimated beam, followed 
by a non-polarizing beamsplitter to randomly choose be¬ 
tween two measurement bases. It is followed by polariza¬ 
tion beamsplitters and single-photon detectors to mea¬ 
sure photons in the four states of polarization: horizontal 
(H), vertical (V), -1-45° (D), and —45° (A) [T1H33] . The 
receiver we test is a prototype for a quantum commu¬ 
nication satellite |36] . operating at 532 nm wavelength 
[Fig. Sa, c)]. Its telescope consists of a focusing lens 
LI (diameter 50 mm, focal length / = 250 mm; Thor- 
labs AC508-250-A) and collimating lens L2 (/ = 11 mm; 
Thorlabs A397TM-A). The collimated beam of < 2 mm 
diameter then passes through a 50:50 beamsplitter BS 
(custom pentaprism |36j ) and pairs of polarization beam¬ 
splitters PBSl and PBS2 (Thorlabs PBS121). PBS2 in¬ 
creases the polarization extinction ratio in the reflected 
arm of PBSl. Lenses L3 (Thorlabs PAF-X-18-PC-A) fo¬ 
cus the four beams into 105 qm core diameter multimode 
fibers (Thorlabs M43L01) leading to single-photon detec¬ 
tors (Excelitas SPCM-AQRH-12-FC). 

Long-distance free-space QKD receivers are multimode 
for two reasons. First, propagation of Alice’s beam, ini¬ 
tially single-mode, through a turbulent atmosphere splits 
it into multiple spatial modes m- Second, the finite pre¬ 
cision and speed of real-time angular tracking of Alice’s 
beam requires that Bob accepts multiple spatial modes 
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FIG. 1. (color online). Experimental setup, (a) Scheme of the experimental apparatus, top view (drawing not to scale). Eve’s 
source consists of a fiber-coupled 532 nm laser, attenuator A, polarization controller PC, and a collimating lens mounted on a 
two-axis motorised translation stage. The latter allows changing the beam’s incidence angle and lateral displacement at Bob’s 
front lens LI simultaneously. Green (light gray) marginal rays parallel to the optical axis denote the original alignment of 
Alice’s beam to Bob. Red and blue (dark gray) marginal rays show a scanning beam from Eve tilted at an angle {<j>, 0) relative 
to the original beam. Eeatures 0^0 mark different transmission paths for light inside Bob. (b) Normalized detection efficiency 
77 in channel V versus the illumination angle (<(>, 6). This scan was taken to show the features clearly by placing Eve at a closer 
distance, (c) Photograph of Bob’s receiver. The actual distance between facing surfaces of L2-BS is 42 mm, BS-PBSl 66 mm, 
PBS1-L3 31 mm, PBS1-PBS2 45 mm, PBS2-L3 10 mm in channel A and 5 mm in channel V. 


in a certain acceptance angle [M m HH EH]- Use of 
single-mode fibers under these conditions would lead to 
additional coupling losses > 10 dB [39] if the system does 
not include appropriate (and often expensive) adaptive 
correction optics m- Therefore, multimode fibers and 
detectors with larger area are generally preferred as they 
allow good collection efficiency without increasing com¬ 
plexity and cost. 


III. EXPERIMENT 

In order to exploit the mismatch in efficiency, Eve 
needs to know the mismatch for the four detectors as 
a function of the input angle. Hence, our first step 
was to scan Bob’s receiver for possible efficiency mis¬ 
match. Eve’s source [Fig. [^a)] consists of a 532 nm 
laser coupled into single-mode fiber, attenuator A, polar¬ 
ization controller PC, and a collimating lens L4 (Thor- 
labs C220TME-A) mounted on a two-axis motorised 
translation stage (Thorlabs MAX343/M). In Fig. [^a), 
green (light gray) marginal rays denote the initial align¬ 
ment from Eve, replicating the alignment from Alice to 
Bob. This is the initial position of the translation stage 
(j) = 9 = 0. As we moved the stage in the transverse 
plane, it changed the beam’s incidence angle and lateral 
displacement at Bob’s front lens LI simultaneously. This 


is shown by red (dark gray) marginal rays in Fig. ma), 
representing a beam from Eve coming at an angle (^, 9) 
relative to the initial beam. 

Before scanning, the optics in Bob’s apparatus was 
aligned to maximize coupling into all four detectors at 
the normal incidence, which is the standard alignment 
procedure for QKD. Note that many free-space QKD 
systems employ a real-time tracking system to maintain 
this initial alignment We then started 

the scanning procedure that involved first, changing the 
outgoing beam’s angle (^, 9), and then recording the cor¬ 
responding count rate at all four detectors of Bob. For 
each data point, we used an integration time of 1 s. Our 
scan consisted of approximately 100 x 100 data points in a 
square matrix covering the whole clear aperture of Bob’s 
front lens LI. Then during post-processing, for each data 
point for each detector, we subtracted the corresponding 
detector’s background count rate, and then normalized it 
by dividing by the maximum count rate in that detector. 

At first, we did a preliminary scan using optical power 
meters (Thorlabs PM200 with S130C head) that re¬ 
vealed several features, highlighted in Fig. [^b). Around 
(/) = 0 = 0, maximum light coupling resulted in the cen¬ 
tral peak o With increasing scanning angle, the fo¬ 
cused beam started missing the fiber core, and the detec¬ 
tor count dropped off © A region was found when the 
beam reflected off a polished edge of PBS2 back into the 
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FIG. 2. (color online). Angnlar efficiency scan of the receiver, and points of interest. Four pair of plots H, V, D, A shown in 
both 3D and 2D represent normalized detection efficiency in the fonr receiver channels versus illuminating beam angle ((f>,9). 
The angle <() = 0 = 0 is the initial angle of QKD operation. The last plot shows angle ranges with a high mismatch, usable in 
our attack. 


fiber core, causing the peak © Increasing the angle fur¬ 
ther made the beam hit the anodized aluminum mount of 
LI and possibly edges of other lens mounts and round el¬ 
ements in the optical assembly. It was scattered at these 
edges, producing two ring-like features 0 Beyond these 
features, there were no noticeable power reading, as the 
beam completely missed the receiver aperture. 

We then adjusted the receiver setup to minimize the 
peak ©, and performed final scans at 26.1 m distance 
using Bob’s single-photon detectors (Excelitas SPCM- 
AQRH-12-FC). During these scans, the beam at LI was 
Gaussian-shaped with 9 mm width (at 1/e^ peak inten¬ 
sity). The scans were done in 38.3 p-rad steps covering 
±1.84 mrad range, corresponding to lateral displacement 
of ±48 mm at LI. Figure]^ shows the normalized detec¬ 
tion efficiency in all four receiver channels as a function of 
((^, 0). Most of the original features are still visible. How¬ 
ever, outside the narrow central range of angles close to 
(j) = 0 = 0, individual channel’s efficiencies vary inde¬ 
pendently. Also, the size and shape of the central peak 
is significantly different between channels. This was im¬ 
possible to identify during the normal alignment proce¬ 
dure. This effect can be attributed to imprecise focus¬ 
ing, optical path length difference between the arms, off- 
centered alignment of lenses, mode-dependent bending 
loss in fibers, and individual variations in components. 
These may have also caused the efficiency at one side of 
the outer ring being higher. Because of these reasons, 
there exist angles such that if photons are sent at those 
angles, one channel has a much higher click probability 
than the rest. 


IV. ATTACK MODEL 

To emphasize the security threat, it is useful to model 
an attack that exploits the discovered side-channel. One 
possible attack is the faked-state attack [ 301110 ], which is 


an intercept-and-resend attack in which Eve attempts to 
deterministically control Bob’s basis choice and detection 
outcome. We model a practical faked-state attack using 
the obtained data and the following assumptions: Al¬ 
ice and Bob perform non-decoy-state Bennett-Brassard 
1984 (BB84) protocol using polarization encoding. Alice 
emits weak coherent pulses with mean photon number /r 
equal to Alice-Bob line transmittance |5] . Whenever Bob 
registers a multiple click, he performs a squashing oper¬ 
ation (double-click in one basis is mapped to a random 
value in that basis, while multiple clicks in different bases 
are discarded) |TOH5] . Alice and Bob also monitor to¬ 
tal sifted key rate, and quantum bit error ratio (QBER). 
Eve has information about Bob’s receiver characteristics 
described above, and only uses devices available in to¬ 
day’s technology. She intercepts photons at the output 
of Alice, using an active basis choice and superconduct¬ 
ing nanowire detectors, with overall detection efficiency 
r]f. = 0.85 and dark count probability < 10“® per bit slot 
|4i] . Then, a part of her, situated close to Bob, regener¬ 
ates the measured signal and sends to Bob. We assume 
that Alice-Bob and Alice-Eve fidelity F = 0.9831 [36], 
while Eve-Bob experimentally measured F = 0.9904. 
Here fidelity refers to the probability that a polarized 
photon will emerge from the PBS at the correct path, 
which is related to visibility by F = (1 ± visibility)/2. 
We also confirmed experimentally that Eve-Bob fidelity 
is preserved at all illumination angles shown in Fig. [^ 

From Eve’s point of view, she wants to maximize the 
detection probability when Bob measures in compati¬ 
ble (i.e., same as her) basis, to maximize Eve-Bob mu¬ 
tual information. Also, she wants to minimize Bob’s 
detection probability in non-compatible basis, to min¬ 
imize QBER. Let ? 7 i(j) be the efficiency of Bob’s z-th 
channel (z € {h,v,d,a}) given that incoming light is 
j G {H, V, D, A} polarized. Thus to find attack points for 
the j-th polarization, we choose angles that have higher 
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values of r]j{j) and 6j{j) = min | where 

r]ncO and r]nci are the normalized efhciencies of the two 
detectors in the non-compatible basis. Our experimental 
attack angles are shown in the rightmost plot in Fig. 
For example, the FI attack angles were composed of points 
for which rjh^H) > 0.2 and 6h{H) > 75. Similarly, for 
the V, D and A attack angles, rjyiV) > 0.002, 5v > 8 ; 
m{D) > 0.4, 5d > 80; r^a{A) > 0.1, 5a > 20. The 
thresholds used here to find the attack angles were not 
optimal, and were picked manually. 

To derive the key rate and QBER formula in Eve’s 
presence, we start with a system with only Eve and Bob. 
Let’s consider Eve sending an iF-polarized pulse to Bob 
within the attack angles H. Before squashing, the raw 
click probability Pi{j) that detector i in Bob clicks given 
Eve has sent j-polarized light is 


Ph{H) « 
Pv{H) ~ 
Pd{a){H) 


Ch + l- exp 
-F 1 — exp 


PHFrih{H) \ 

2 ) ’ 




Cd(a) + 1 - exp - 


PHVd{a){H) 


( 1 ) 


where pn is Eve’s mean photon number and Ci is Bob’s 
background click probability per bit slot in i-th channel. 
The probability Phv{H) that after squashing Bob mea¬ 
sures in FIV basis, given Eve has sent an iJ-polarized 
pulse, is composed of three events: when only detector H 
clicks, when only detector V clicks, or when both click. 
It can be written as 

PhAH)=[l-p^{H)][l-pa{H)] 

X [Ph{H) + Py{H) - ph{H)py{H)]. 



FIG. 3. (color online). Modeled QBER observed by Bob ver¬ 
sus line loss. The dotted curve shows QBER without Eve. At 
lower line loss, the QBER is due to imperfect fidelity, while at 
higher line loss Bob’s detector background counts become the 
dominant contribution. The lower solid curve (blue) shows 
QBERg under our attack when only the total Bob’s sifted key 
rate Rat is matched. The upper solid curve (red) additionally 
keeps his four channel rates equal. 


where Pi{j) is the probability that Bob measures value i 
after squashing, given Eve has sent j-polarized light. For 
example, 

P,iH) = [l-p,{H)] [l-Pa{H)]. 

( 5 ) 

Sifted key rates and errors in Eve’s presence [Eqs. ([^ 
and @] conditioned on V, D, A polarizations sent by 
Alice can be calculated similarly. The total sifted key 
rate and QBER in Eve’s presence become 


■Re = ^ ReU), 

^ j=H,V,D,A 

QBERe=4^ E 

j = H,V,D,A 


( 6 ) 


Let’s now include Alice into the picture. Consider Al¬ 
ice sends an iJ-polarized pulse, and Eve intercepts it. Let 
P^ « i(l - and P^ « - 

g-/j(i-F) 77 e^ be the probability that Eve measures in the 
compatible basis (i.e., the same basis as Alice) and gets a 
click only in the correct and wrong detector respectively. 
Let « 5(1 — e“^)e““ 2 ^ be the probability that 
she measures in the non-compatible basis (different basis 
than Alice’s) and gets a click in a single detector. The 
sifted key rate given Alice has sent iF-polarized light is 

ReiH) ^P^PhviH) + PZPhv{V) + P^, [PhviD) + PUA)] 

+ (1 - P! -P^- 2 P„%)(c, + c„ - c,c„). 

( 3 ) 

An error can occur when Eve measures Alice’s signal in 
non-compatible basis or when Eve measures in compati¬ 
ble basis but Bob measures a wrong value owing to im¬ 
perfect fidelity or dark count. Hence, the error rate con¬ 
ditioned on Alice sending iF-polarized light is 


Eh « P!P.iH) + P^P.iV) + P-, [P,iD) + P„(A)] 




+ (1-P,^-P^-2P:J(c„-A^), 


( 4 ) 


The only free parameters left for Eve to manipulate 
are the mean photon numbers of her signal. Knowing 
the angular scanning data. Eve can use a numerical opti¬ 
mization to find values of pn, PVi Pd, Pa that minimize 
QBERg while keeping Re = Rab, where Rat is Bob’s 
sifted key rate without Eve. Our numerical optimiza¬ 
tion achieves this for Alice-Bob channel loss > 3 dB 
if they are willing to accept a slight increase of QBER 
by less than 0.7% (see Eig. |^. Here we assumed Bob’s 
detector parameters as measured by us: efficiency at 
(f) = 6 — 0 was 0.4 in all four channels, and individual de¬ 
tector background count probabilities were in the range 
of 430 X 10“® to 1560 x 10“® per 1 ns coincidence window. 
These optimization results are realistic conditions for a 
successful attack on most communication channels m- 
na m [201 m Eg Note that the distance Eve-Bob can 
be increased without affecting attack performance, by re¬ 
placing Eve’s illuminator with four collimators oriented 
at the required attack angles. 

We went further and imposed an additional constraint 
on Eve to make Re{F[) = Re{V) = Re{D) = Re{A) = 
Rab- Our optimization shows that it is still possible 
for Eve to pick appropriate mean photon numbers and 
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FIG. 4. (color online). Angular efficiency scan of the receiver after a 25 fi.m diameter pinhole (Thorlabs P25S) is placed 
in the focal plane of LI, L2 [Fig. [^a)]. No detectable mismatch between channels was found under tight search conditions 
Vi{j) > 0.001 and Si{j) > 4. 


successfully attack the system with resultant QBER < 
6.82% in 3-15 dB line loss range (Fig. |^. Similar QBER 
values are typical for outdoor channels, because of back¬ 
ground light. Eve could shield Bob from the latter to 
hide QBER resulting from her attack. 

We would like to point out that the attack angles de¬ 
pend on the way the setup is constructed, the imperfec¬ 
tions of each individual sample of component, and each 
individual alignment procedure. I.e., no two setups are 
identical, even if they are produced in the same assem¬ 
bly line, and they will generally have different attack 
angles. However, from a theoretical point of view, in 
quantum cryptography it is assumed from Kerckhoffs’ 
principle that except for the keys themselves. Eve 
has knowledge about all other parameters in the system. 
It is thus a valid assumption that she knows the attack 
angles. From a practical point of view. Eve may try tech¬ 
niques proposed in [dOj . She may replace a small fraction 
of the signal states with faked states at different spatial 
angles, then listen to the classical communication to get 
an estimate of the efficiency of Bob’s detectors at those 
angles. In this way she may gradually improve her esti¬ 
mate on the mismatch without causing excessive QBER. 
When she has enough information on the statistics of the 
mismatch, she can launch her full-fledged attack. 

V. COUNTERMEASURES 

In our attack, by sending lights at different angles. Eve 
has broken a fundamental assumption of security proofs 
that detection probabilities are independent of detection 
basis [d6l Hz]. We propose to restore this assumption 
by placing a spatial filter (pinhole) at the focal plane of 
Bob’s LI and L2 [Fig. [^a)]. Spatial filtering is some¬ 
times done before the beamsplitters to increase signal- 
to-background ratio in the channel [n [m EU, how¬ 
ever it has not been characterised as a security coun¬ 
termeasure. We performed scanning with 100, 75, and 


25 pm diameter pinholes, and found that decreasing the 
pinhole diameter gradually reduces the mismatch. The 
25 pm diameter pinhole eliminated any visible mismatch 
(Fig. ® even though we reduced our search parameters 
to ? 7 i(j) > 0.001 and 6i > 4. This pinhole provides Bob’s 
field-of-view of 100 prad, which does not reduce his effi¬ 
ciency with turbulent atmospheric channels m- Hence, 
we conclude that a 25 pm pinhole may be an efficient 
countermeasure for the current setup. 

Note that, in Refs. EHI and US) a detector scrambling 
strategy was proposed that might be an effective coun¬ 
termeasure against efficiency mismatch attacks for single¬ 
photon qubits. However, it is not clear how effective that 
countermeasure is, when one considers that the detectors 
operate on optical modes, not on single-photon signals. 
This can be a future study. 


VI. CONCLUSION 

Our analysis implies that data obtained during a QKD 
session can be explained by an intercept-resend attack ex¬ 
ploiting the spatial mode side-channels. Therefore, there 
is no postprocessing or privacy amplification that can 
eliminate Eve’s knowledge without sacrificing all key |49j . 
Although our practical attack should work, and the phys¬ 
ical countermeasure seems promising, there is still room 
for improvement on both the attack scheme and counter¬ 
measures. Eve can employ more attack angles or combine 
this attack with some other suitable attack schemes, to 
increase the number of her free parameters. Alice and 
Bob can make this harder by monitoring more parame¬ 
ters. We expect that our attack can be conducted also in 
the related decoy-state protocol [SD] , though the require¬ 
ment to match the correct decoy statistics will modify 
the parameter regime where it will be effective. Another 
possible future study is to fully implement the present 
attack under realistic outdoor channel conditions. 
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